Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 18:52

General

  • Target

    b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    b4ab2fcf8aa81fe076c31d6e8b392c76

  • SHA1

    b2440db183b05f70f7101179794bd71c29a6aa7b

  • SHA256

    3850b1d3a2c23e1af2159577d39dd80bfd6b7523c3407e4328913d5a8afcb551

  • SHA512

    31add694eaa2ebdda6503c51551454da44fa42b8b5ba6ad58bddc4bd319fe66e7b9e5c3e7bddd6cbd4bd53169788c7a656930966389acb0f1e0d94170f3d284e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwh

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2964
      • C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b4ab2fcf8aa81fe076c31d6e8b392c76_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2384
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2476
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:624
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              PID:2244
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:4680
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                PID:2332
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:4720
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                        PID:4840
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    PID:2660
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:2696
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:1308
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      PID:1872
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:5900
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:992
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        PID:2932
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        PID:2548
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:1532
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        PID:2328
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:6876
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          PID:2084
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:6960
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            PID:1860
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            PID:964
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:7136
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              PID:2280
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              PID:2884
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:5188
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:2440
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:2600
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:2728
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1876
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3036
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:616
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:312
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2160
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1752
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2732
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1928
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2060
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1496
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1092
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1788
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1004
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:3048
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:848
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1064
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1772
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:888
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2588
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2236
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1232
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:452
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2292
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1120
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2408
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2304
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1544
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2272
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1868
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1764
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3020
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3052
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1708
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:392
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2260
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2708
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:876
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2852
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2764
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1488
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2560
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1400
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1812
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1008
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:924
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Drops file in Windows directory
                                  PID:2140
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                    PID:1736
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:1568
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:1536
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:2508
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:2704
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:2864
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:2620
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:1340
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:2912
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2056
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2504
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:3132
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:3284
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    PID:3436
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    PID:3600
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:3760
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:3916
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Drops file in Windows directory
                                                        PID:4076
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Drops file in Windows directory
                                                        PID:3276
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:3412
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:1664
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:3756
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3996
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3080
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:3356
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3544
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:3732
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:3904
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:1036
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:3368
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:3540
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:3740
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:3944
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                              • Drops file in Windows directory
                                                                              PID:3272
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                              • Drops file in Windows directory
                                                                              PID:3564
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:3164
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:4088
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:3400
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:3676
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:3240
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:4052
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:3516
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                          • Drops file in Windows directory
                                                                                          PID:3824
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:4004
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:3480
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                              • Drops file in Windows directory
                                                                                              PID:3804
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:4040
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:2676
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:3868
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:3076
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:3844
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:3188
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:3832
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:3176
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:3912
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:3712
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:3448
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:2264
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:4036
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                    PID:4064
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:3380
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                      PID:3244
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:3716
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:3924
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:3144
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2532
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                          PID:4224
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          PID:4384
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                            PID:4536
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4700
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:4860
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                                PID:5020
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4160
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4336
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4520
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                  PID:4708
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:4932
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                      PID:3220
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:4304
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                          PID:4496
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4696
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4876
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:3352
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4300
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4572
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4784
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:5028
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4256
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                              PID:4504
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                                PID:4760
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                  PID:5036
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4568
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4484

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Windows\Parameters.ini

                                                                                                                                              Filesize

                                                                                                                                              74B

                                                                                                                                              MD5

                                                                                                                                              6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                              SHA1

                                                                                                                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                              SHA256

                                                                                                                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                              SHA512

                                                                                                                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                            • \Windows\system\explorer.exe

                                                                                                                                              Filesize

                                                                                                                                              2.2MB

                                                                                                                                              MD5

                                                                                                                                              64ee0c12dd682771b99960641d9817b1

                                                                                                                                              SHA1

                                                                                                                                              9f4151436feaf0762d2fd69447891eeb0e9c1827

                                                                                                                                              SHA256

                                                                                                                                              4a6d87f41f3f4489d73fd43707633f6648b08726bfb49c05597d06a17221f1c6

                                                                                                                                              SHA512

                                                                                                                                              c71de0b917b935b6b64871e8de73379881e89007be3ff37ae90831ac0998da05d336afae5f2c1a38c2dca69bd587043039b94e924eb4a04ebacb15bdd8837661

                                                                                                                                            • \Windows\system\spoolsv.exe

                                                                                                                                              Filesize

                                                                                                                                              2.2MB

                                                                                                                                              MD5

                                                                                                                                              9ce00ad55efbd02b1275a2baaeac8ad7

                                                                                                                                              SHA1

                                                                                                                                              750c7cdc665d7bd9d18c515c3deb2ab4c652206b

                                                                                                                                              SHA256

                                                                                                                                              3da3d919aad76b2f254e7dce208bd5e82ba98a1a90f87af40a22b22c278ebb6e

                                                                                                                                              SHA512

                                                                                                                                              ca04750e1b11ecf1bcf5614e26ea48d7b7df62885d32ebe2c8705521a5b01975e0c1e250530c78cdc410ef3a213c50209e41598a615351b7b41f345e28da1fa9

                                                                                                                                            • memory/312-3434-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/616-3433-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/624-2377-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/964-2893-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/992-2383-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1004-3448-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1092-3443-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1308-5556-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/1496-3441-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1532-2889-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1752-3436-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1788-3444-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1860-2892-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1872-2382-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1876-3431-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/1928-3438-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2060-3439-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2084-2891-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2160-3435-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2244-2378-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2280-2899-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2328-2890-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2332-2379-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2384-48-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/2384-27-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/2384-24-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/2384-20-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/2384-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2440-2901-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2476-59-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2476-69-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2476-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2548-2888-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2600-2902-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2660-2380-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2696-2381-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2732-3437-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2784-17-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2784-0-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2784-28-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2784-19-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2884-2900-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/2932-2887-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/3036-3432-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                            • memory/4612-5544-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/4680-5532-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/4720-5531-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/4720-5601-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/5900-5585-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB

                                                                                                                                            • memory/6200-5597-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              248KB